What to check before you give an AI tool your notes

Is it safe to put your notes into AI?

You have a term's worth of lecture notes, or a month of client calls, and an AI tool that could answer questions across them. Before you paste them in, it's worth ten minutes to check what happens next.

There's no single yes or no. It depends on what's in the notes and on what the particular tool does with them. The practical answer is to check five things first: who can see what you enter, whether it's used to train or improve the service, how long it's kept and whether you can delete it, where it's stored and who processes it, and what your school's or employer's rules say. And before any of that, look at the notes themselves.

This guide is general guidance, drawn from official sources. It isn't legal advice, and it doesn't describe how any particular product behaves. For that, read the tool's own privacy policy and terms.

Start with what's in your notes

Lecture notes on the cardiac cycle are low risk. Notes from a meeting about a colleague's performance are not. Before you use any AI tool, sort what you're about to share:

• Other people's personal information: names, contact details, health details, what someone said about themselves.
• Opinions about people. The Office of the Victorian Information Commissioner, a data protection regulator in Australia, notes that personal information includes opinions about individuals (OVIC, 2025).
• Confidential work material: client details, unreleased plans, anything under a confidentiality agreement.
• Your own private thoughts, such as a journal.

If a note falls into one of these groups, either leave it out, remove the identifying details first, or be sure the tool's terms allow for it.

1. Who can see what you type?

The company that runs the tool can usually see what you send it. The UK's National Cyber Security Centre put it plainly in its guidance on large language models: the query will be visible to the organisation providing the service, and queries are stored and will almost certainly be used for developing the service or model at some point. It recommends not including sensitive information in queries to public tools (NCSC, 2023).

Look in the privacy policy for who has access to your content: staff, contractors, or reviewers who check conversations for quality or safety.

2. Is it used to train or improve the service?

Many services describe whether your content may be used to train or improve their models, and some offer a setting to opt out. Find that section and read it, rather than assuming either way.

Promises matter. The US Federal Trade Commission has warned AI companies that they must abide by their commitments to customers regardless of how or where the commitment was made, and that using customer data for other purposes calls for clear and conspicuous notice and affirmative express consent (FTC, 2024). That's US guidance, but it shows why the written policy is the thing to check.

3. How long is it kept, and can you delete it?

Check the retention period, and whether deleting a chat or a note deletes it everywhere, including backups and any training use. OVIC's guidance warns that information entered into a publicly available AI tool may be retained indefinitely by the company that owns it, and that once it's entered, it may not be possible to extract it again.

If you're in the UK or EU, data protection law gives you rights over personal data, including the right to ask an organisation to delete it. The UK Information Commissioner's Office explains that this right to erasure only applies in certain circumstances, and that an organisation can refuse fully or partly if an exemption applies (ICO). So check the tool's own deletion options too.

4. Where is it stored, and who processes it?

Your notes may be stored or processed in another country, by the company itself or by other companies it uses, such as hosting providers. Writing for Victorian organisations, OVIC notes that information entered into such tools is likely to be stored outside Victoria, in many cases in places without equivalent privacy and security laws. A good privacy policy names the companies that process your data for it and says how transfers abroad are covered.

5. What do your school's or employer's rules say?

Many universities and employers have rules about which AI tools may be used, and with what data. OVIC, for example, says Victorian public sector organisations should make sure their staff don't enter personal information into publicly available AI tools. Your organisation's rules may be stricter or looser, but they apply to you either way. If client or patient information is involved, ask before you paste.

A five-minute checklist

1. 1Sort the notes: is there anyone else's personal information, or anything confidential?
2. 2Open the tool's privacy policy and find the sections on access, training, retention and deletion.
3. 3Check the settings for a training or history opt-out, and decide whether to use it.
4. 4Look up where data is stored and which other companies process it.
5. 5Check your school's or employer's AI policy.
6. 6If you're still unsure, remove names and identifying details, or leave that note out.

Where Lumyo stands today

Lumyo is pre-launch, and the app isn't available yet. Our privacy policy covers this website and the waitlist: when you join, the only thing we ask for is your email address. The policy also says the Lumyo app will have its own policy when it launches. When it does, read it with the same five questions in mind. Those questions apply to every tool, including ours.